odoo/addons/purchase/security/purchase_security.xml

<?xml version="1.0" encoding="utf-8"?>
<openerp>
<data noupdate="1">

    <record id="group_purchase_manager" model="res.groups">
        <field name="name">Purchase / Manager</field>
    </record>
    <record id="group_purchase_user" model="res.groups">
        <field name="name">Purchase / User</field>
    </record>


    <record model="ir.rule.group" id="purchase_order_comp_rule_group">
        <field name="name">Purchase Order multi-company</field>
        <field name="model_id" ref="model_purchase_order"/>
        <field name="global" eval="True"/>
    </record>
    <record model="ir.rule" id="purchase_order_comp_rule">
        <field name="field_id" search="[('model','=','purchase.order'),('name','=','company_id')]" model="ir.model.fields"/>
        <field name="rule_group" ref="purchase_order_comp_rule_group"/>
        <field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
    </record>

    <record model="ir.rule.group" id="purchase_order_line_comp_rule_group">
        <field name="name">Purchase Order Line multi-company</field>
        <field name="model_id" ref="model_purchase_order_line"/>
        <field name="global" eval="True"/>
    </record>
    <record model="ir.rule" id="purchase_order_line_comp_rule">
        <field name="field_id" search="[('model','=','purchase.order.line'),('name','=','company_id')]" model="ir.model.fields"/>
        <field name="rule_group" ref="purchase_order_line_comp_rule_group"/>
        <field name="domain_force">['|',('company_id','=',False),('company_id','child_of',[user.company_id.id])]</field>
    </record>

</data>
</openerp>